US-CERT Cyber Security Alert SA07-310A -- Apple QuickTime Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


   National Cyber Alert System
   Cyber Security Alert SA07-310A

Apple QuickTime Updates for Multiple Vulnerabilities

   Original release date: November 6, 2007
   Last revised: --
   Source: US-CERT

Systems Affected

   Vulnerabilities in Apple QuickTime affect
     * Apple Mac OS X
     * Microsoft Windows

Overview

     Apple has released Apple QuickTime 7.3 to correct several
     vulnerabilities. These vulnerabilities could allow an attacker to
     gain access to your computer.

Solution

Upgrade QuickTime

     OS X users should use the Mac OS X Software Update feature to
     download and install Apple QuickTime 7.3. Consider scheduling
     Software Update to check for updates automatically (this option is
     enabled by default).

     Microsoft Windows users should upgrade to Apple QuickTime 7.3.

Description

     QuickTime prior to version 7.3 has multiple image and media file
     handling vulnerabilities that could allow an attacker to run
     malicious programs on your computer. This could happen by visiting
     a malicious web site. Upgrading to Apple QuickTime version 7.3 will
     correct these vulnerabilities.

     Note that Apple iTunes installs QuickTime, so any system with
     iTunes is vulnerable.

     For more technical information, see US-CERT Technical Security
     Alert TA07-310A.

References

  * US-CERT Technical Alert TA07-310A -
    <http://www.us-cert.gov/cas/techalerts/TA07-310A.html>

  * About the security content of the QuickTime 7.3 Update -
    <http://docs.info.apple.com/article.html?artnum=306896>

  * Apple QuickTime 7.3 for Windows -
    <http://www.apple.com/support/downloads/quicktime73forwindows.html>

  * Apple QuickTime Download -
    <http://www.apple.com/quicktime/download/>

  * Mac OS X: Updating your software -
    <http://docs.info.apple.com/article.html?artnum=106704>

  * Securing Your Web Browser -
    <http://www.us-cert.gov/reading_room/securing_browser/>


References
  _________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/alerts/SA07-310A.html>
 _________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert@cert.org> with "SA07-310A Feedback VU#208011" in the
   subject.
 _________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 _________________________________________________________________

   Produced 2007 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 _________________________________________________________________

Revision History

   November 6, 2007: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRzD7PfRFkHkM87XOAQKmCwf9GlIVqbUZ18Efa7Ri3399TmzI790MixUf
yim4uDrAMbaMkJ9eY8+NjmAnl0jr1d2/Vh6UwUzBLoTaYsSsv/Bg1P1U0haN/Qt5
eYhXvnH8zaXnuBL8zg9lOyHnDj5Mr7Dxq4o1iLpGY4XqogD5ErFzjv1gYirwgyiI
LVHaTFtaJvjawx6asCIbOBvjhgfSsjloiFpLeZUGQqBOogsaBzHGip+NKW1NMG7n
7Anqdu8pLBDL+WDMBKyeoAGsC4msejAZMle6sZ88IRILgXyjjgwn7Y2+0dfRSf9D
ZNZwhTHbHtdgAVJK+Y/PnAeiraNihW68fgdJ/Zut6oSPcKIsYcR87g==
=VwwF
-----END PGP SIGNATURE-----